How Much Cyber Insurance Does Your Small Business Need?

For many companies, cyber insurance renewal season is approaching. That usually means answering another application, gathering information from the IT provider, and deciding how much coverage to buy.

The difficult part is not checking the boxes. It is deciding whether the policy would provide enough help during a serious incident.

You may hear that a small business should carry somewhere between $1 million and $5 million in cyber insurance. Those are common limits in the market, but they are not a reliable rule of thumb. A suitable limit depends on how your business operates, how much downtime it can absorb, what data it holds, what its contracts require, and how much loss it can pay on its own.

The better question is not, “What does a business our size usually buy?”

It is, “What could a realistic cyber incident cost us, and how much of that loss are we willing and able to keep?”

What happens during underwriting?

Most insurers do not perform a complete cybersecurity assessment for you. The process more often starts with an application or underwriting questionnaire. Depending on the insurer and the business, it may also include interviews, supporting documents, or an outside-in scan of systems visible from the internet.

The questions may cover multi-factor authentication, backups, patching, endpoint protection, employee training, incident response planning, privileged access, vendors, and other controls. Those answers can affect eligibility, premium, deductible or retention, available limits, sublimits, and exclusions.

New York’s Department of Financial Services describes cyber underwriting as a process that commonly begins with surveys and interviews about governance and security controls, sometimes supplemented by external risk evaluations. It also encourages insurers to price policies based on the effectiveness of the applicant’s cybersecurity program. That is a good reason to treat the application as a serious business record, not routine paperwork. Read the Cyber Insurance Risk Framework.

Answer every question based on what is working today. Do not answer based on a project you intend to finish later. If your application says every remote connection uses MFA or every critical system is covered by tested backups, you should be able to support that answer with evidence.

Choose a limit by modeling financial loss

Start with a simple loss model. You do not need a perfect forecast. You need a reasonable view of the costs that could arrive at the same time.

Consider at least these categories:

• Lost income and continuing expenses during downtime
• Extra costs to keep serving customers manually or through temporary systems
• Digital forensics, incident response, and crisis support
• Legal advice and regulatory response
• System and data restoration
• Customer notification, call center, and credit-monitoring costs
• Cyber extortion and fraud, if those events are covered
• Claims made by customers, vendors, or other third parties
• Contractual obligations and regulatory costs where insurable
• Public relations and other recovery expenses

The Federal Trade Commission’s cyber insurance guidance recommends evaluating both first-party and third-party coverage. First-party coverage addresses costs your own business incurs. Third-party coverage addresses claims brought against your business by others. Most companies need to consider both sides of the loss.

A simplified example

Assume a small business wants to model a serious incident that disrupts operations for 10 days.

These are example numbers, not market averages. Your numbers could be much lower or much higher.

For the downtime estimate, do not simply multiply daily revenue by 10. Consider lost income, continuing payroll and fixed expenses, delayed billing, contractual penalties, overtime, temporary services, and the portion of delayed sales that may never be recovered.

If the modeled loss is about $500,000, buying exactly $500,000 of coverage may still leave little room for uncertainty. A $1 million limit could be reasonable in this example, but only after reviewing the policy terms, available sublimits, and the amount the business can retain. The right answer may be different if legal defense costs reduce the main limit, a major category has a lower sublimit, or several claims share one annual aggregate.

Model more than one incident

One estimate is not enough. Build at least three scenarios:

Moderate incident

A routine but significant incident might cost $75,000. Examples could include a contained email compromise, a short outage, limited forensic work, legal advice, and recovery labor.

Severe incident

A severe incident could involve 10 days of disruption, substantial restoration work, customer notification, and a third-party claim. The example above estimates that loss at $500,000.

Catastrophic incident

A catastrophic event could cause extended downtime, loss of a critical vendor, widespread data exposure, regulatory work, and substantial third-party liability. This is where a business may discover that a $1 million limit is not enough.

The goal is not to predict one exact event. It is to understand the range of loss and decide where insurance should begin and end.

Read the numbers underneath the headline limit

A policy can show a $1 million limit and still provide far less than $1 million for the event you are most worried about.

The National Association of Insurance Commissioners has reported that insurers responded to increased losses by raising deductibles and adding sublimits. It also notes that some policies contain “failure to maintain security” or similar exclusions. Read the NAIC Cyber Insurance Report.

Review these details before choosing between quotes:

• Sublimits: A $1 million policy may have a much smaller limit for social engineering, wire transfer fraud, cyber extortion, dependent business interruption, notification, or restoration.
• Deductible or retention: Understand how much the business pays before coverage responds and whether different coverage sections have different amounts.
• Waiting period: Business interruption coverage may begin only after systems have been down for a stated number of hours.
• Aggregate limit: Multiple losses and expense categories may share one total limit for the policy year.
• Defense costs: Confirm whether legal defense costs are inside the limit and reduce the money left for settlements or other losses.
• Exclusions: Pay attention to prior incidents, known vulnerabilities, failure to maintain security, war or hostile acts, infrastructure failure, and other excluded events.
• Incident response requirements: The policy may require prompt notice, insurer approval, and the use of designated legal, forensic, recovery, or negotiation firms.
• Vendor and cloud outages: Confirm whether an incident at a critical technology provider can trigger dependent or contingent business interruption coverage.
• System failure: Some policies focus on malicious attacks. Determine whether non-malicious outages, human error, or failed updates are covered.
• Other insurance: Ask how the cyber policy interacts with crime, property, general liability, professional liability, and technology errors and omissions coverage.

Policy language varies. The Minnesota Department of Employment and Economic Development advises businesses to review existing policies with an insurance agent because cyber terms and exclusions can differ widely.

Do not wait until the application arrives

Improving security can strengthen your underwriting position, but changes made just before renewal may not produce an immediate premium reduction. Pricing also depends on the insurer, industry, claims history, revenue, requested limits, market conditions, and other factors outside your control.

Start several months before renewal when possible. Use that time to:

1. Review last year’s application and confirm that every answer is still accurate.
2. Gather evidence for important controls such as MFA, endpoint protection, backup isolation, restoration testing, security training, patching, and incident response planning.
3. Identify gaps between the application, the policy, and the way the business actually operates.
4. Estimate moderate, severe, and catastrophic losses.
5. Compare quotes by coverage, sublimits, exclusions, response services, and retention, not premium alone.
6. Document improvements that can be completed now and build a plan for the next renewal cycle.

Security improvements do more than support an insurance application. They can reduce the chance of an incident and lower the damage when one occurs. Insurance transfers part of the financial risk. It does not replace prevention, response planning, or recovery capability.

Questions to ask before you bind coverage

Bring these questions to your licensed insurance agent or broker:

• Is this limit per event, annual aggregate, or both?
• Which losses have sublimits, and how do those sublimits compare with our modeled costs?
• Do defense costs reduce the main limit?
• What deductible, retention, and waiting period applies to each coverage section?
• When does business interruption begin, and how is lost income calculated?
• Are outages at our cloud, payroll, managed service, or software providers covered?
• Are social engineering and fraudulent funds transfer covered, and under which section?
• Which response firms must we use, and what requires advance approval?
• Which security statements or continuing obligations could affect a claim?
• How does this policy interact with our other insurance?

For legal interpretation of policy language, exclusions, or coverage disputes, involve qualified counsel.

Make the limit a business decision

Choosing a cyber insurance limit requires more than comparing premiums. It requires a review of critical operations, financial exposure, security controls, contractual obligations, risk tolerance, and recovery capability.

That calculation will be different for every business.

MN Risk can help your team model cyber loss scenarios, review the technical assumptions behind an application, validate security controls, compare the operational differences between quotes, and prepare practical questions for your licensed insurance professional. If this year’s renewal is already close, we can also build an improvement plan for the next one.

The goal is not to buy the biggest policy. It is to avoid discovering a major gap when the business is already dealing with an incident.

Start a conversation about cyber insurance readiness

This article provides general educational information. It is not legal advice, insurance advice, or a recommendation to purchase a particular policy or limit. Coverage depends on the specific policy language and circumstances. Work with a licensed insurance professional and qualified legal counsel when making coverage decisions.